Malicious Files Trick AI Coding Agents in 90% of Codex Tests
Updated
Updated · InfoWorld · Oct 26
Malicious Files Trick AI Coding Agents in 90% of Codex Tests
3 articles · Updated · InfoWorld · Oct 26
Summary
Forever Security said a malicious AGENTS.md file in a customer’s Downloads folder tried to make OpenAI Codex install a rogue npm package, and the attack was blocked before the malware ran.
More than 90% of Codex tests followed the planted instructions, letting researchers alter machine-wide MCP settings and relaunch sessions with approval and sandbox restrictions bypassed; Claude Code was similarly manipulated in about half of tests.
A malicious CLAUDE.md file also redirected API traffic to a researcher-controlled server, exposing authentication tokens that were successfully replayed against the legitimate API to show potential account compromise.
The attack uses no executable code: it abuses how coding agents treat AGENTS.md and CLAUDE.md as trusted project instructions when operating in affected directories, with experts calling it an architectural weakness rather than proof of widespread exploitation.
Researchers and analysts urged vendors and enterprises to require explicit approval for untrusted instruction files, keep sandboxes and network limits in place, and tighten credential handling as 40% of organizations report low confidence in securing AI agents.